A security analyst receives a PCAP file and is asked to determine if data exfiltration occurred over HTTPS to a known-bad IP. SSL/TLS inspection is not available. Which technique provides the most useful intelligence without decrypting the traffic?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because even without decryption, TLS metadata (certificate anomalies, JA3 fingerprints matching known malware, large asymmetric data transfers, and beaconing intervals) provides strong exfiltration indicators without breaking encryption. A is wrong because brute-forcing TLS session keys is computationally infeasible in practice.
Full explanation below image
Full Explanation
B is correct because even without decryption, TLS metadata (certificate anomalies, JA3 fingerprints matching known malware, large asymmetric data transfers, and beaconing intervals) provides strong exfiltration indicators without breaking encryption. A is wrong because brute-forcing TLS session keys is computationally infeasible in practice. C is wrong because blocking without analysis does not confirm exfiltration and destroys the investigative opportunity. D is wrong because TLS encrypts the payload; strings will only show handshake metadata, not application data.